Attackers are using this September 28, 2026 Critical severity

CoreGraphics flaw used in targeted attacks

A flaw in CoreGraphics, part of macOS. Processing a maliciously crafted file may lead to arbitrary code execution. Apple says this may have been exploited in targeted attacks, and CISA lists it as actively exploited.

On a Mac

Every Mac still on an affected version. The fix comes with the macOS update.

The fix

• macOS 15.8.1 and 26.7.1

Attacks

In CISA’s catalog of exploited flaws since September 29, 2026.

CVE

CVE-2026-86950

Sources

• support.apple.com
• support.apple.com
• cisa.gov

From the Briefing, updated 19 minutes ago.